Opening an AI tool to the organization is technically easy: a license is bought, a button is pressed, and the next day everyone is using it. The real question should be asked before pressing that button: What data will this tool see?
In most organizations the answer is not clear. Because AI tools that connect to your organization’s data, such as Microsoft 365 Copilot, see the documents the user can already access. A folder shared with “everyone” over the years, a broad permission left over from an old project, a site nobody knows the owner of; all of them come within the tool’s field of view. The tool does not open a new door; it goes through all the existing doors.
So the first job is to put the data in order, not the tool. We call this “your data map”: what is in which system, who accesses it, which is sensitive, who owns it. It comes out in four steps.
Step one: inventory of systems and shares
First list the places where data sits. File servers, SharePoint sites, OneDrive spaces, Teams teams, accounting and customer software, e-mail attachments. In most organizations this list is longer than expected; areas that were opened years ago and forgotten turn up.
Write two pieces of information on each line: what is there and who accesses it. The question “who accesses it” is answered not by the organization chart on paper but by the real permissions in the system. The gap in between is the most instructive part of the exercise.
Step two: sensitivity classes
Not all data needs the same care. Sort every area in the inventory into a few classes: public, internal, personal data, trade secret and so on. Keep the number of classes small; four or five classes are enough for most organizations, and more than that will not be applied.
This classification does two jobs. First, it makes clear which areas the AI tool should not access. Second, it becomes the basis for the next steps: labeling and data loss prevention policies are built on these classes.
Step three: ownership table
Every data area should have an owner: the person who will say “yes” or “no” when a permission is granted. An area without an owner is the riskiest area; nobody reviews the permissions, nobody closes old access.
An ownership table is a short list: area, owner, backup owner. It is easy to prepare, and expensive to be without. After the AI tool is opened, the person to ask “why does it see this document?” is in this table.
Step four: high-risk data list
When the inventory, the classes and the owners come together, a short list appears by itself: areas in a sensitive class that are shared widely. A payroll folder opened with an “everyone” permission, a contract site shared with external users, a customer list whose owner has left.
This list is the list of what needs to be fixed before the AI tool is opened. The fix is a separate job and is done with a separate approval; but without the list you cannot know what to fix.
What happens after the map
Once the map is out, the AI decision becomes concrete. Which user group it will be opened to, with which data areas, in which order is no longer a guess but a plan based on the inventory. A pilot group is chosen, high-risk areas are closed or narrowed, then the tool is opened.
The map is not made once and put on a shelf. It is updated when a new site is opened, when an employee leaves, when a project ends. The ownership table exists for this.
Where to start
You do not have to do it all at once. For most organizations the right start is the data inventory or scanning the sharing permissions; each creates value on its own and prepares the ground for the other steps.
In our AI readiness consulting, we do this work as the first of seven modules: its outputs are the inventory of systems and shares, sensitivity classes, an ownership table and a high-risk data list. The second module is the oversharing check for Copilot: SharePoint, OneDrive and Teams permission scanning, an external sharing report and a remediation plan. You can start with a single module; each module has a written output. For modules 2 and 3, read permission is needed in your tenant; the scope is determined in writing and the work is done under your supervision.
Also on this topic: AI readiness consulting and training · Microsoft 365 Copilot
Do you want to map your data before opening an AI tool? Let us decide together, in a short call, which module to start with.
